Analysis
- max time kernel
116s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/06/2021, 07:07
General
- Target No.Purchase Order 02902-28361.exe
- Size 321KB
- Sample210624-mc3agls2nx
- SHA256 cc43f37f9eb41430bbfb6f1515b65c5fd2bc7b7565701c71aa65731fdf46c288
Malware Config
Extracted
-
asyncrat
-
0.5.6A
-
lambertofield1.ddns.net:1515
-
79.134.225.124:1515
-
ubbgqgwizl
-
aes_key
MAa0OfWTKZeWOryYtjTHg2b3gFYQBA8d
-
anti_detection
false
-
autorun
false
-
bdos
false
- delay
-
host
lambertofield1.ddns.net,79.134.225.124
-
hwid
5
- install_file
-
install_folder
%AppData%
-
mutex
ubbgqgwizl
-
pastebin_config
null
-
port
1515
-
version
0.5.6A
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 2 IoCs
- Drops startup file 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\No.Purchase Order 02902-28361.exe"2⤵
- Drops startup file
-
-
C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"C:\Users\Admin\AppData\Local\Temp\No.Purchase Order 02902-28361.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3628-123-0x0000000005120000-0x0000000005121000-memory.dmp
memory/3628-127-0x0000000006270000-0x00000000062D6000-memory.dmp
memory/3628-119-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/3628-120-0x0000000004CC0000-0x00000000051BE000-memory.dmp
memory/3628-121-0x0000000004F00000-0x0000000004F41000-memory.dmp
memory/3628-122-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/3628-114-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3628-116-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/3628-125-0x00000000062E0000-0x00000000062E1000-memory.dmp
memory/3628-117-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/3628-118-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
memory/3852-128-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3852-133-0x00000000057E0000-0x00000000057E1000-memory.dmp